The period of time that business records are stored should be determined by a retention schedule that takes into consideration the records’ usefulness to the business as well as legal requirements. From a risk management perspective, once this period has passed, the only acceptable way of discarding these records is to destroy them using a method that ensures complete destruction. Oftentimes, documenting the exact date and method used for destruction is not only prudent but a legal requirement.